CVE-2025-21754

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix assertion failure when splitting ordered extent after transaction abort

If while we are doing a direct IO write a transaction abort happens, we mark all existing ordered extents with the BTRFSORDEREDIOERR flag (done at btrfsdestroyorderedextents()), and then after that if we enter btrfssplitorderedextent() and the ordered extent has bytes left (meaning we have a bio that doesn't cover the whole ordered extent, see details at btrfsextractorderedextent()), we will fail on the following assertion at btrfssplitorderedextent():

ASSERT(!(flags & ~BTRFSORDEREDTYPE_FLAGS));

because the BTRFSORDEREDIOERR flag is set and the definition of BTRFSORDEREDTYPE_FLAGS is just the union of all flags that identify the type of write (regular, nocow, prealloc, compressed, direct IO, encoded).

Fix this by returning an error from btrfsextractorderedextent() if we find the BTRFSORDERED_IOERR flag in the ordered extent. The error will be the error that resulted in the transaction abort or -EIO if no transaction abort happened.

This was recently reported by syzbot with the following trace:

FAULTINJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 faildump lib/fault-inject.c:53 [inline] shouldfailex+0x3b0/0x4e0 lib/fault-inject.c:154 shouldfailslab+0xac/0x100 mm/failslab.c:46 slabpreallochook mm/slub.c:4072 [inline] slaballocnode mm/slub.c:4148 [inline] _dokmallocnode mm/slub.c:4297 [inline] _kmallocnoprof+0xdd/0x4c0 mm/slub.c:4310 kmallocnoprof include/linux/slab.h:905 [inline] kzallocnoprof include/linux/slab.h:1037 [inline] btrfschunkallocaddchunkitem+0x244/0x1100 fs/btrfs/volumes.c:5742 reservechunkspace+0x1ca/0x2c0 fs/btrfs/block-group.c:4292 checksystemchunk fs/btrfs/block-group.c:4319 [inline] dochunkalloc fs/btrfs/block-group.c:3891 [inline] btrfschunkalloc+0x77b/0xf80 fs/btrfs/block-group.c:4187 findfreeextentupdateloop fs/btrfs/extent-tree.c:4166 [inline] findfreeextent+0x42d1/0x5810 fs/btrfs/extent-tree.c:4579 btrfsreserveextent+0x422/0x810 fs/btrfs/extent-tree.c:4672 btrfsnewextentdirect fs/btrfs/direct-io.c:186 [inline] btrfsgetblocksdirectwrite+0x706/0xfa0 fs/btrfs/direct-io.c:321 btrfsdioiomapbegin+0xbb7/0x1180 fs/btrfs/direct-io.c:525 iomapiter+0x697/0xf60 fs/iomap/iter.c:90 _iomapdiorw+0xeb9/0x25b0 fs/iomap/direct-io.c:702 btrfsdiowrite fs/btrfs/direct-io.c:775 [inline] btrfsdirectwrite+0x610/0xa30 fs/btrfs/direct-io.c:880 btrfsdowriteiter+0x2a0/0x760 fs/btrfs/file.c:1397 doiterreadvwritev+0x600/0x880 vfswritev+0x376/0xba0 fs/readwrite.c:1050 dopwritev fs/readwrite.c:1146 [inline] _dosyspwritev2 fs/readwrite.c:1204 [inline] _sesyspwritev2+0x196/0x2b0 fs/readwrite.c:1195 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f1281f85d29 RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29 RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003 R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328 </TASK> BTRFS error (device loop0 state A): Transaction aborted (error -12) BTRFS: error (device loop0 state A ---truncated---